A good and simple web tool to monitoring Lan ?

wolffnx

wolffnx

Hi , I am looking for a web tool for monitor the LAN traffic , something simple, like www/sarg , for view the destinations ip's access,timestamp of access,and bandwith consumed
maybe with some graphics of stadistics..but is optional
there is a hundred of tools but all bloated of functions that not need...
thanks in advance
 
There is net/sniffnet.

There is also security/suricata which you can run in just IDS mode to get all the info.
I started wiring a read-only GUI for that. Most of the message dispatching, processing etc. is in place. Pretty much only the GUI stuff is missing and I feel bored by doing GUI stuff so we probably won't see that one any time soon :D
 
jbo said:
There is net/sniffnet.

There is also security/suricata which you can run in just IDS mode to get all the info.
I started wiring a read-only GUI for that. Most of the message dispatching, processing etc. is in place. Pretty much only the GUI stuff is missing and I feel bored by doing GUI stuff so we probably won't see that one any time soon :D
Click to expand...

sniffnet needs a X11 server running ?

Code: 
thread 'main' panicked at 'Failed to initialize any backend! Wayland status: XdgRuntimeDirNotSet X11 status: XOpenDisplayFailed', /wrkdirs/usr/ports/net/sniffnet/work/sniffnet-1.2.1/cargo-crates/winit-0.27.5/src/platform_impl/linux/mod.rs:719:9                                                                                                                   
note: run with `RUST_BACKTRACE=1` environment variable to display a backtrace
 
I'm not upstream support.
But yes, it's a GUI application written in Rust using either X or Wayland.

You didn't really specify what you were looking for ;-)
security/suricata runs headless. Then you can build your own GUI (as I started doing mentioned above).
 
jbo said:
I'm not upstream support.
But yes, it's a GUI application written in Rust using either X or Wayland.

You didn't really specify what you were looking for ;-)
security/suricata runs headless. Then you can build your own GUI (as I started doing mentioned above).
Click to expand...

no way..no X in my firewall :) , yes, I am reading about suricata , and trying to make it work,but is hard work..very hard
 
It's literally just pkg install suricata and then starting the service:

/etc/rc.conf:
Code: 
suricata_enable="YES"
suricata_interface="<interface>"

service suricata start
 
sorry, I dont explain the scenario, is a firewall for 400 user aprox , providing internet to the LAN and some input conections from outside
 
wolffnx said:
is a firewall for 400 user aprox
Click to expand...
wolffnx said:
yes, I am reading about suricata , and trying to make it work,but is hard work..very hard
Click to expand...
These things together sound a bit like a red flag to me. You're the admin of a firewall servicing 400 users while also having trouble installing & configuring a piece of software available via ports?

What exactly do you try to achieve here? Unless you force plain text connections to your gateway you won't be able to sniff traffic so the best you can do in such a scenario is building a list of source/destination connections. For such a scenario, something like security/snort3 or security/suricata should suffice.
 
jbo said:
These things together sound a bit like a red flag to me. You're the admin of a firewall servicing 400 users while also having trouble installing & configuring a piece of software available via ports?

What exactly do you try to achieve here? Unless you force plain text connections to your gateway you won't be able to sniff traffic so the best you can do in such a scenario is building a list of source/destination connections. For such a scenario, something like security/snort3 or security/suricata should suffice.
Click to expand...

sniffnet was a waste of time, so, suricata is my choise, after reading documentation,examples I made my first rule, a simple icmp alert
so..so far so good, the only thing that is missing is monitor the bandwith of users
I am new in suricata but I think that dont support that..lets keep reading
 
wolffnx said:
view the destinations ip's access,timestamp of access,and bandwith consumed
Click to expand...
For simply collecting such flow data (at scale!) you might want to look at collecting netflow data from various points in your network (e.g. edge routers, gateways and switches) via net-mgmt/nfdump. There are some visualization tools like net-mgmt/nfsen or net-mgmt/flowviewer, but netflow data can also be fed (directly or pre-processed/filtered) to e.g. zabbix for moitoring & alerting.

sarg, snort and suricata are much more geared towards specific protocols (i.e. web traffic) and/or DPI, not flow data.
 
You must log in or register to reply here.
Back
Top